Article 29 Working Party Issues Updated Guidance On BCRS
On May 22, 2015, the Article 29 Working Party published an update to its explanatory document regarding the use of Binding Corporate Rules (BCRs) by data processors (WP204). The original explanatory document was published on April 19, 2013 and identified two scenarios in which a non-EU processor, processing personal data received under BCRs, should notify the controller and the relevant data protection authorities (DPAs) in the event of a legally binding request for the personal data. Although the Working Party 's guidance provides helpful clarification, there remains a number of unresolved questions. BCRs for processors remain an evolving area of EU data protection law, and it is likely that we will see further guidance on these issues from DPAs and the Working Party as increasing numbers of processors begin to use BCRs.